Which versions of BullSequana XH are affected by EUVD-2025-210890?

Bull BullSequana XH3406 and XH3515 HPC servers contain a critical vulnerability in their baseboard management controller that enables unrestricted administrative access following factory reset…

How to fix or mitigate EUVD-2025-210890?

Within 24 hours: conduct a complete inventory of Bull BullSequana XH3406 and XH3515 servers in your environment and immediately isolate their BMC interfaces from untrusted networks; restrict access to administratively-managed segments only. Within 7 days: implement dedicated management VLANs for BMC traffic with firewall rules limiting connectivity to authorized administrative jump-hosts; enable comprehensive audit logging on all BMC access attempts and review current user accounts for necessity. Within 30 days: establish monitoring for Bull security advisories and test any available firmware updates in a non-production environment before deployment; document formal change-control procedures for BMC firmware updates; request explicit patch timeline and interim protection recommendations directly from Bull support.

BullSequana XH EUVD-2025-210890

Q: What is the CVSS score of EUVD-2025-210890?

EUVD-2025-210890 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:L/U:Clear. EPSS exploitation probability: 0.1%.

| CVE-2025-15679 HIGH

Empty Password in Configuration File (CWE-258)

2026-09-11 Bull

GHSA-g65q-w5wj-wm56

Bullsequana Xh3406 Bullsequana Xh3515

7.3

CVSS 4.0 · Vendor: Bull

Severity by source

Vendor (Bull) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:L/U:Clear

vuln.today AI

9.3 CRITICAL

Local access to BMC management interface required (AV:L); once triggered state exists, no credentials needed (PR:N); BMC control over host constitutes scope change (S:C) with full impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Bull).

CVSS VectorVendor: Bull

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 11, 2026 - 09:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 11, 2026 - 09:01 vuln.today

CVE Published

Sep 11, 2026 - 08:02 cve.org

HIGH 7.3

DescriptionCVE.org

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password.

AnalysisAI

BMC root account activation without a password on Bull BullSequana XH3406 and XH3515 HPC servers enables full out-of-band management compromise following a factory reset or equivalent triggering operation. With a PoC available (CVSS 4.0 E:P) and no privileges required once the vulnerable state exists, an attacker with access to the BMC management interface can achieve complete control over the managed server, including power cycling, firmware manipulation, and console access. No active exploitation is confirmed in CISA KEV at time of analysis.

Technical ContextAI

The Baseboard Management Controller (BMC) is an independent microcontroller embedded in server hardware that provides out-of-band management capabilities - including power control, console redirection, hardware monitoring, and firmware update - independent of the host OS state. CWE-258 (Empty Password in Configuration File) describes the root cause: under specific lifecycle events such as a factory default reset, the BMC firmware activates the root account without initializing a password, leaving it open to unauthenticated login. Affected products per CPE are cpe:2.3:a:bull:bullsequana_xh3406:*:*:*:*:*:*:*:* and cpe:2.3:a:bull:bullsequana_xh3515:*:*:*:*:*:*:*:*, both belonging to the Atos/Bull BullSequana XH family of HPC blade/rack systems. Affected version ranges are unbounded in NVD CPE data, suggesting broad version exposure. The BMC typically exposes IPMI, Redfish REST API, and a web management interface on a dedicated out-of-band management network.

RemediationAI

The primary remediation is to apply the vendor-released patch or firmware update referenced in the Atos customer advisory at https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eJrEVAA0 - exact fixed versions are not publicly disclosed and require authenticated portal access. As an immediate compensating control, administrators should audit all BMC root accounts following any factory reset or system reimage operation and immediately set a strong, unique password on the BMC root account before connecting the system to the management network. Restrict access to the BMC management interface (IPMI port 623/UDP, Redfish port 443) to authorized management hosts using network-layer ACLs, ensuring the BMC management plane is isolated on a dedicated VLAN with strict access controls. Disable or rename the BMC root account where vendor firmware supports alternative admin accounts. Monitor BMC authentication logs for unexpected root login events following maintenance operations.